On: Show HN: Monocypher: a small, easy to use crypto l...

[tptacek]

Right, then, so these aren't really security tests. I'm suggesting you reword that bit on your page; passing test vectors doesn't make something more trustworthy; it's table stakes.

I'm not saying you shouldn't write tests for misuse cases! You should do that.

[loup-vaillant → tptacek]

Okay, what's a security test? How is it any different from a mere correctness test? Can you suggest some link to read up, or some tool to use?

[arnarbi → loup-vaillant]

See e.g. https://github.com/google/wycheproof

Fuzzing tests can also uncover weird bugs and edge cases that can lead to vulnerabilities.